b9b02ee1a72f0345b9b4ae4d02c5ca2d8df3ba62b5920db9c388ef724db39e21

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
30/08/2023, 16:30

Target

e26d9bca80b06c92fa2b859ffa8ecd13_mafia_JC.exe
Size

414KB
MD5

e26d9bca80b06c92fa2b859ffa8ecd13
SHA1

ca234bfb303eb56766ac17f41b9fa9d6a3b8b7ec
SHA256

b9b02ee1a72f0345b9b4ae4d02c5ca2d8df3ba62b5920db9c388ef724db39e21
SHA512

326ed5c18b6d391074a760f48ab6a7d1467884d7fb8b41b4b71da6d7f1d9fc5bd8d0c1d1a28f4f7f47a35a5dda934f355fb41c19c33ffd16f664b21872cecbb1
SSDEEP

12288:Wq4w/ekieZgU6qCNDDnQt4no43+dviQQlx:Wq4w/ekieH6qcDK4no0+gr

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3036	8ABB.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 3036	2480	e26d9bca80b06c92fa2b859ffa8ecd13_mafia_JC.exe	81
PID 2480 wrote to memory of 3036	2480	e26d9bca80b06c92fa2b859ffa8ecd13_mafia_JC.exe	81
PID 2480 wrote to memory of 3036	2480	e26d9bca80b06c92fa2b859ffa8ecd13_mafia_JC.exe	81

C:\Users\Admin\AppData\Local\Temp\e26d9bca80b06c92fa2b859ffa8ecd13_mafia_JC.exe
"C:\Users\Admin\AppData\Local\Temp\e26d9bca80b06c92fa2b859ffa8ecd13_mafia_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Users\Admin\AppData\Local\Temp\8ABB.tmp
  "C:\Users\Admin\AppData\Local\Temp\8ABB.tmp" --helpC:\Users\Admin\AppData\Local\Temp\e26d9bca80b06c92fa2b859ffa8ecd13_mafia_JC.exe FEAF844B89DE1C6B1BB028531DBA6DFF66D4CAE97CAD879990C33140C033FF91EF7552FD1211221080E1650F851DFDDE28061E673BA6465DBE1604432954AC4A
  2⤵
  - Executes dropped EXE
  PID:3036

C:\Users\Admin\AppData\Local\Temp\8ABB.tmp

Filesize
414KB

MD5
ac85c898e14aa761deba3ffedbd77599

SHA1
58b17911bd69940603fec949921ca59b5a60a381

SHA256
bb0769ddb2e7b1ed95806b4993c2b145ea6d24205dce893cc7a6762c84a62a4e

SHA512
7ecc27c36be5c01c9b1bf6edbed0ef35cd46e41ffca4b47870defc1c2dcfc2277d6eab88a133bbe33741553415900aba5bf694153a77ad66a418f7a392e31dfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\8ABB.tmp

Filesize
414KB

MD5
ac85c898e14aa761deba3ffedbd77599

SHA1
58b17911bd69940603fec949921ca59b5a60a381

SHA256
bb0769ddb2e7b1ed95806b4993c2b145ea6d24205dce893cc7a6762c84a62a4e

SHA512
7ecc27c36be5c01c9b1bf6edbed0ef35cd46e41ffca4b47870defc1c2dcfc2277d6eab88a133bbe33741553415900aba5bf694153a77ad66a418f7a392e31dfc

Download Submit